Routers throughout networks (e.g., the Internet), may be configured to process network traffic based on information contained in the network traffic itself. For example, some companies have tried to manipulate quality of service settings for packets associated with file sharing applications. Conventional methods may attempt deep packet inspection (DPI) to detect an application with which a packet is associated. DPI is the act of examining packet payload contents. However, DPI is unreliable as DPI may have difficulty making an accurate determination when the contents of the payload are encrypted. Additionally, DPI may be slow and/or resource intensive (e.g., memory, processing, and so forth). Thus, regular use of DPI may introduce latency in network devices causing network slowdowns and reducing data transfer speeds. Further some DPI implementations may have high false positive rates, and false negatives may be introduced by manipulating packet payloads with polymorphic techniques (e.g., computer viruses that rewrite their code).
Some routers use statistical classification techniques to augment other classification techniques instead of using DPI. However, some conventional statistical classification techniques are computationally high cost, slow, and therefore impractical for some typical classification scenarios. Additionally, some conventional statistical classification techniques do not reach a conclusion about a given data stream until after the stream has terminated.